Why doesn't kvStore lookup work, but join does?

[plaid_blanket]

I've got a kvStore lookup, AD_Obj_user, defined with fields objectSid, OU, sAMAccountName, and others.  It has case-insensitive matching.

I've got events that contain the field Sid.  I want to lookup the sAMAccountName and automate the lookup, but right now not even the manual lookup works.

This works:

| inputlookup AD_Obj_User where objectSid=S-1-2-34-56789012-345678901-234567890-123456

    | table objectSid sAMAccountName OU

but this does not work:

index=windows_client source="WinEventLog:PowerShell"  Sid=S-1-2-34-56789012-345678901-234567890-123456
| lookup AD_Obj_User objectSid AS Sid 
| table  OU Sid

I can do the lookup successfully, manually, by using this:

index=windows_client source="WinEventLog:PowerShell" Sid=S-1-2-34-56789012-345678901-234567890-123456
| eval objectSid=Sid
| join type=left objectSid [| inputlookup AD_Obj_User 
    | table objectSid sAMAccountName OU]
| eval User=sAMAccountName
| fields - sAMAccountName

but it won't get me towards automating the lookup.

Any ideas?  I'm stumped.

[plaid_blanket]

Nope, no luck.

If it helps, doing the lookup DOES do something, because this

index=windows_client source="WinEventLog:PowerShell" Sid=S-1-2-34-56789012-345678901-234567890-123456
| eval objectSid="this has content"
| lookup AD_Obj_User objectSid AS Sid OUTPUT objectSid
| table  OU Sid objectSid

returns a table that has the Sid column populated, but the other two columns blank (i.e., the lookup overwrites the "this has content" stuff in objectSid).

[shivanshu1593]

Try like this:

index=windows_client source="WinEventLog:PowerShell"  Sid=S-1-2-34-56789012-345678901-234567890-123456
| lookup AD_Obj_User objectSid AS Sid OUTPUT objectSid as Sid
| table  OU Sid

++If it helps, please consider accepting as answer++